1. Field of the Invention
The present invention concerns the remote transfer of display data between two computers in which public data must be differentiated from private data. The invention in particular concerns a method for exchanging image data composed of a number of image elements that are respectively parameterized by a display value set (for example HSL or RGB values).
2. Description of the Prior Art
Confidential patient data that must be protected from unauthorized access are normally located on the local control computers of medical technology apparatuses. This is particularly problematic given the remote maintenance (servicing) of one computer via another computer (known as remote administration in a computer network), which is becoming widespread. During such servicing, the patient data must thus be protected from access by the service personnel since otherwise a violation of the data protection exists. Sensitive data can be known only to the control program on the local computer, for example the patient browser of the software for the implementation of a magnetic resonance examination. For the remote service computer these data cannot be “visible” on the screen of the serviced computer.
However, the automatic concealment of the patient data on the service computer often fails because the known tools for remote maintenance of another computer (such as, for example, PC Anywhere (trade name of Symantec corporation) operate at the operating system level and essentially transfer the content of the screen buffer in a compressed form over the network.
Selective masking of the patient data is a possibility, but is made more difficult because where the patient data are situated on the screen is not known to the program for controlling the remote maintenance (known as the administration tool) and again it is not known to the local control program whether a remote access to the local computer ensues at a given moment, since both computers operate in a transparent mode in the remote servicing.
An obvious approach would appear to be to transfer the information contained in a data field to a remote maintenance computer or not depending on the position of said data field on the screen. The communication of coordinates on a screen to another computer is known. A method for mapping of screen contents of a local computer on a remote computer is known from U.S. Pat. No. 6,710,790, for example. This method according to the prior art for display of at least one part of a computer display of a remote computer in at least one part of a display device (wherein the part is defined by a movable display rectangle) includes the following steps. In the remote computer, a copy of the display image on the host computer is generated. A new active window notification is received from the host computer that specifies an active window rectangle. The active window notification corresponds to a part of the copy of the image on the display of the host computer. A determination is made as to whether the movable viewing rectangle intersects the rectangle of the active window. If it is detected in this determination that the movable viewing rectangle does not intersect the rectangle of the active window, the movable viewing rectangle is moved so that it intersects the active window rectangle.
In order to protect sensitive data with such a method, it would be necessary for sensitive and public data always to be displayed in a specific pattern on the screen. Such a provision represents a severe limitation and is too complicated to achieve in practice. All appertaining programs would have to be outfitted and retrofitted with corresponding interfaces.
By contrast, when the local control program is provided with an interface via which the program for the remote maintenance communicates to the local control program that an access has occurred (is occurring), the local control program can then black out the corresponding screen fields and show them again at the end of the access. This procedure has the disadvantage that the measurement workflow is thereby interrupted since the patient data are temporarily no longer displayed on the local control computer. This entails an interruption of the workflow. Furthermore, extensive changes to the local control program are necessary to set up such an interface that registers the establishment of a remote connection, and a complex dependency on the control program and the remote maintenance is produced, making further development of the system more difficult. Moreover, dependencies between program modules in the field of medical technology are particularly critical since any change to the management software or the local controller also forces changes of the other software, such that a new approval proceeding is necessary both for the new local control program and for the remote maintenance. This expenditure is in many cases disproportionate.